Secure detection network system

ABSTRACT

A secure detection network system includes plurality of remote nodes, each remote node comprising a set of detector interfaces configured to couple to a set of detectors disposed to detect the presence of an illegal asset within a shipping container; at least one server node configured to initialize, install, and authenticate each remote node in the plurality of remote nodes, including delivering to each remote node an agent module, said agent module for each remote node comprising a node specific configuration file defining a set of nodes with which the remote node can communicate and a different encryption means corresponding to each node in the set of nodes; and a communication path coupling the plurality of remote nodes and the at least one server node.

CROSS-REFERENCE TO RELATED PATENT APPLICATIONS

This application is a continuation of U.S. application Ser. No.12/277,100 entitled SECURE DETECTION NETWORK SYSTEM, filed Nov. 24,2008, now U.S. Pat. No. 7,930,761, which is a continuation of U.S.patent application Ser. No. 10/600,738, filed Jun. 20, 2003, entitledSECURE DETECTION NETWORK SYSTEM, now U.S. Pat. No. 7,475,428, whichclaims the benefit of priority under 35 U.S.C. §119(e) from co-pending,commonly owned U.S. provisional patent application Ser. No. 60/390,204,entitled WEAPON DETECTION METHOD AND SYSTEM, filed Jun. 20, 2002 andU.S. provisional patent application Ser. No. 60/390,205, entitledORTHOGONAL SECURITY SYSTEMS FOR PROTECTING HIGH RISK INFRASTRUCTURE,filed Jun. 20, 2002, and which is a continuation of commonly owned U.S.non-provisional patent application Ser. No. 09/441,403, entitled SYSTEMAND METHOD FOR INSTALLING AN AUDITABLE SECURE NETWORK, filed Nov. 16,1999, now U.S. Pat. No. 6,918,038.

STATEMENT OF GOVERNMENT INTEREST

The U.S. Government has no interest in or to the present invention.

FIELD OF THE INVENTION

The inventive concepts relate to systems and methods for ensuringsecurity of sensitive assets. More specifically, the present inventionsrelates to systems and methods that implement secure communications toensure security of the sensitive assets.

BACKGROUND

There has been a recognition that the United States is at risk of thedelivery of weapons of mass destruction to its ports by enemiesemploying a strategy of hiding such a weapon in a shipping container.Various schemes have been proposed for x-raying containers or otherwiseexamining containers as they are loaded on ships in the foreign port.Such schemes, however, can be very limited in effectiveness since theycan be defeated with x-ray shielding, vulnerable to compromise by rogueemployees and the contents of the containers altered after they areloaded in the foreign port.

To a limited degree, the notion of embedding detecting devices in acontainer, which communicate with external systems, has been implementedin unsecure applications. For example, Sensitech, based in Beverly,Mass. (www.sensitech.com), provides solutions in the food andpharmaceuticals fields that are used for monitoring temperature andhumidity for goods in-process, in-transit, in-storage, and on-display.So, temperature and humidity monitors can be placed in storage andtransit containers to ensure desired conditions are maintained.

However, such data is not generally considered sensitive with respect tosecurity issues. Rather, it is used for ensuring the products in thecontainer do not spoil by being subjected to unfavorable temperature andhumidity conditions. Consequently, secure communications, tamperresistance and detection are not particularly relevant issues in suchsettings. Additionally, such monitors do not monitor for the presence ofsuspicious content or materials, no matter where they may be introducedin the chain.

Even if detectors are introduced into a container and interfaced to anexternal system, an “enemy” may employ any of a variety of strategies todefeat such a detection system. For instance, an enemy may attempt toshield the suspicious materials or activities from the detectors; defeatthe communication interface between the detectors and the externalsystem, so that the interface does not report evidence of suspiciousmaterials or activities sensed by the detectors; disconnect thedetectors from the interface; surreptitiously load a container thatcontains an atomic weapon, but that does not contain detecting devices,onto a container ship; overcome external systems so that theyincorrectly report on the status of the detectors.

The difficult aspect of the environment is that the detecting devicesand the communications interface will be in the hands of the potentialenemy for some period of time, at least for the period of time necessaryto load the container. Also, since the potential enemy is presumedcapable of constructing an atomic weapon, the enemy must be presumedable to utilize other advanced technologies suitable for defeating thedetecting devices and the interface.

SUMMARY OF THE INVENTION

A system and method for providing a secure detection network systemincludes a plurality of nodes, each node comprising a processor andstorage means. Such nodes include a plurality of remote nodes, eachremote node comprising a set of detector interfaces configured forcoupling to a set of detectors disposed for detecting the presence of anillegal condition. The illegal condition may include the presence of oneor more suspicious materials, including chemical weapons, biologicalweapons, nuclear weapons, chemical agents, biological agents,radioactive materials, illegal drugs, explosive materials or devices, orshielding means. The illegal condition may also include a suspiciousactivity, including an attempt to defeat a remote node or detector. Theremote nodes can be provided within a tamper resistant box, that couldbe coupled to a sensitive, for example. Sensitive assets could include,for example, assets such as a shipping container, vehicle, human, event,room, area or building. Within the box may also be provided a set ofdetectors. The detectors are configured to detect the illegal condition,and could also detect an attempt to compromise the detector, remotenode, or sensitive asset.

To establish a secure network, and each node therein, at least oneserver node generates and distributes to each node an intelligent agentmodule and a set of node specific configuration files, selectivelyincluding software and data files. For each node, the configurationfiles include information defining for that node a set of other nodeswith which the node can communicate. This includes providing a differentencryption means corresponding to each node in the set other nodes.Installation of a node includes executing the downloaded to agent andconfiguration files. Once installation is complete, strobing of theencryption means (e.g., key pairs) between nodes can be included.

At least one monitor node can be provided to couple to and audit othernodes in the secure network, including the remote nodes. This auditingfunction may include receiving signals indicating an illegal conditionor tampering with a remote node. A robot node could also be provided, asanother form of monitor node, which could be hosted on a portableplatform. These nodes could include wired or wireless interfaces, ascould the server nodes and the remote nodes.

Selectively causing one or more nodes to terminate communication and toremove itself from the secure network in response to one or moretermination events may also be provided. In such a case, the one or moretermination events could include detecting tampering of one or moreremote nodes.

Communication between remote nodes and other nodes, such as a monitornode or server node, could be accomplished via one or more otherintermediate nodes. Subnetworks may be formed from a set of remotesnodes, wherein each subnetwork could provide a portion of thecommunication path to the monitor node and server node for a givenremote node.

As an additional form of security, orthogonal authentication could alsobe provided, such as by using independent biometric information about anindividual.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawing figures depict preferred embodiments by way of example, notby way of limitations. In the figures, like reference numerals refer tothe same or similar elements.

FIG. 1 is a block diagram of a secure detection system network, inaccordance with the present invention.

FIG. 2 is a block diagram of a portion of the block diagram of FIG. 1,with a plurality of containers.

FIG. 3 is a block diagram of a portion of the block diagram of FIG. 1,with a plurality of containers in a stacked configuration.

FIG. 4 is a block diagram of a massively scalable Secure Network, inaccordance with the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

A system and method in accordance with the present invention provide asecure network having interfaces to detectors configured to detect anyof a number of undesired conditions. Such a system and method providesecurity for network nodes against attacks, whether intentional by anenemy or inadvertent by friendly forces. Such a system and methodinclude a plurality of nodes configured to communicate in a highlysecure and robust manner. Several of the nodes include or interface withone or more detectors, monitors, or sensing devices (collectively,“detectors”) configured to sense the presence or introduction of an“illegal condition”, such as suspicious materials or activities.

Generally, suspicious materials include any material of a nature suchthat, if detected, would present a reason to open a container andexamine it. Such materials could include drugs, nuclear, chemical,biological or other hazardous materials, devices, compositions, oragents, or any weapons or agents of mass destruction, including nuclearweapons, explosives, chemical weapons, and biological weapons, as wellas shielding material that would shield radiation, explosives orbiological weapons from detection. Suspicious materials could alsorepresent materials that were at variance with the materials that theshipper states are supposed to be in the container.

Generally, suspicious activities would involve detection of any activitysuch that, if detected, would represent a reason to open the containerand examine it or to otherwise consider a formerly trusted asset asuntrusted. Suspicious activity could include electromagnetic radiation,sonar, or heat variations, or removal or tampering with a detector orremote node. For example, removing a detector or remote node from acontainer might be indicative of an attack on a detector, node orcontainer. The presence of human beings inside a container after thecontainer had been closed and was ready for shipment would alsoconstitute suspicious activities, or the presence of a human that hasnot been properly authenticated.

In the preferred form, installation, authentication, and auditing ofnodes and secure communication among the nodes is accomplished using thesystems and methods disclosed in U.S. Pat. No. 6,067,582; U.S. Pat. No.6,535,254 B1, and U.S. patent application Ser. No. 09/441,403, all ofwhich are incorporated herein by reference (collectively describing the“Secure Network”). Such a Secure Network is also further described inAppendices A-G hereof.

As an overview, the Secure Network includes at least one server nodethat distributes intelligent agents (or agent modules) to devices, andany other software and data necessary to configure and enable the node.Each agent module is specific to the device to which it is distributed.A device properly configured with an agent module is referred to as anode. The node includes information received from the server node thatidentifies other nodes with which the agent's node is to communicate.Each pair of nodes that is configured to communicate will be configuredwith encryption means unique to that pair of nodes' communication, whichmay take the form of unique key pairs. These key pairs may be strobed tofurther enhance security. The agent module installs any applications orsoftware distributed from the server node to the agent's node. Theserver node may also reinstall the network at any time, e.g., inresponse to loss of a node or a determination that a node has beencompromised. Additionally, a monitor node can be included to audit agroup of nodes.

In the case of human interaction with or auditing of a protected asset(e.g., a container) preferably authentication of the auditor isrequired. In such a case, the authentication could be provided, at leastin part, using orthogonal authentication, i.e., at least two independentmeans of authentication. For example, a first means of authenticationcould be by entry of user ID and password. A second means ofauthentication could be by biometric information (or bioinformatics),such as a palm, hand, finger print, retina, or face scan. Orthogonalauthentication is discussed in greater detail in Appendix B.

There are several exemplary scenarios in which the present invention maybe implemented. In a first scenario, a wireless device or devices (i.e.,“remote nodes”) may be attached to or embedded in shipping containers.The remote nodes may couple by wired or wireless means to variousdetectors configured, for example, to detect weapons of massdestruction. The detectors can be located inside the container anddistributed as needed to adequately perform their surveillancefunctions. The detectors can be packaged with remote nodes or externalto the remote nodes. The remote nodes are queried by appropriateexternal monitor systems to determine if the nodes and detectors havesensed weapons of mass destruction or other contraband. One issue to beconfronted in such a scenario is that an enemy might attempt to sabotageor reverse engineer the nodes so that they falsely report a safe status,so that the container would pass query by authorities. This scenario isreferred to as the shipping container scenario.

In another scenario, wireless remote nodes may be attached to soldiersso that these nodes can be queried on the battlefield to determinewhether a person is friend or foe. One issue here is that an enemy mightcapture the soldiers or the equipment and reverse engineer the wirelessremote node, thereby allowing the enemy to masquerade as a friend.Conversely, friendly forces might mistakenly consider a soldier on thebattlefield who cannot be authenticated to be the enemy and open fire.This scenario is referred to as the soldier scenario.

In yet another scenario, wireless remote nodes may be attached toequipment such as tanks or airplanes. In such a case, the remote nodescan be queried on the battlefield to determine whether the vehicle isfriend or foe. This scenario is referred to as the vehicle scenario.

In still another scenario, wireless remote nodes may be attached toindividuals so that the individuals can gain authorized access to abuilding or an event. An issue to be confronted is that an enemy maycapture an authorized individual, reverse engineer the remote node, andgain unauthorized admission. This scenario is referred to as the passholder scenario.

In each scenario above, the wireless remote node passes through thefollowing stages:

-   -   (1) A secure stage or stages, where the wireless remote node        will be securely provided with cryptographic material.    -   (2) An insecure stage, where the wireless remote node will be        subject to attack by an enemy.    -   (3) A stage where the wireless remote node will be able to        detect an attack by an enemy.    -   (4) A stage where the wireless remote node will be queried by an        external responsible agent (e.g., military or civilian        authorities).

Provided in accordance with one aspect of the present invention, is theability to detect in stage (4) if an enemy attack has occurred in stage(3). This goal could be achieved by providing in stage (4) a measure ofthe probability that an attack has or has not occurred in stage (3). Anadditional goal in the soldier and vehicle scenarios is to positivelyidentify an unknown person or vehicle as friend or foe. Table 1 shows,for each scenario, a set of secure stages and a corresponding set ofattack detection approaches, as examples.

TABLE 1 Scenario Secure Stages Attack Detection Shipping Manufacturingplant Several devices monitor one Container Shipping Line premisesanother inside the same US Port container US Controlled facilitiesSeveral devices monitor one another across different containers Othersensors detect WMD Individual device senses attack against it SoldierSquad room before Device attaches to body mission sensor Presence ofother soldiers or equipment during mission Military Before takeoff orbefore Device attaches to sensors vehicle or mission embedded invehicle. airplane For vehicle, in presence Device attaches to body ofother soldiers or sensors or devices of equipment occupants Pass Fromhome via Device attaches to body holder telephone. sensor Companyfacility

Shipping Container Scenario. Each shipping container would contain oneor more wireless remote nodes that is configured to communicateinternally with one another and externally with other nodes. The remotenodes would include an interface to facilitate coupling to varioussensors disposed to detect the presence of illegal conditions within thecontainer. Such detectors could, for example, be embedded in or attachedto the container, as could be the remote nodes. In addition to sensingthe presence of illegal conditions, the sensors could be configured todetect access to the container, whether authorized or unauthorized.Illegal conditions could be the presence of any one or more of dangerouschemicals, biological agents or radioactive materials, explosives,drugs, or the like.

The shipping container will at various times be in facilities that arerelatively secure, such as the manufacturing plant or a US Port or UScontrolled facility. At these times, the remote nodes can be securelyprovided with cryptographic materials via the Secure Network.

The wireless devices would detect an attack when they sensed prohibitedsubstances or when an individual device sensed that it was beingattacked. Several remote nodes could also continually monitor oneanother inside the container. Adjacent containers could also monitor oneanother.

Soldier Scenario. The soldier will have a wireless device connected to abody sensor. An attack will be sensed when reports from the body sensorindicate that something is amiss or when the body sensor is removed. Asoldier can include a soldier, an airman or any person that formallyparticipates in military missions. Prevention of friendly fire instancesis an important goal of the soldier wireless device.

The soldier is in a relatively secure environment in the squad roombefore leaving for a mission and on the battlefield in the visualpresence of other soldiers. At these times, the soldier can be providedwith cryptographic material using Secure Network methodologies.

Military Vehicle or Airplane Scenario. The number of friendly fireinstances in the Iraq war indicates the need for methods of securelyidentifying unknown vehicles and aircraft. The invention describedherein can be used to assure identification of vehicles and airplanesover wireless. Of course, in practice on the battlefield, it will beextremely important to have a system that tests that the wirelessidentification systems are correctly operating immediately before avehicle or airplane is put into combat.

Pass Holder Scenario. A pass holder is an individual who is authorizedto enter a facility or attend an event. The pass holder carries awireless device which is queried at the point of admission. The passholder also has a body sensor, possibly a wrist band, to which thewireless device communicates. The wireless device records an alarm whenthe body sensor is removed or when the body sensor records some otherevent. The issue with the pass holder is to deliver the cryptographicmaterial in a secure manner.

One possibility is for the pass holder to become authenticated at homebefore leaving for the event. The pass holder would put on the wristband, and have the wireless device communicate with a remote authorityvia wireless or wired network and receive the cryptographic material andthen undergo an authentication procedure using perhaps the telephone ora biometric device in his house. This system would allow a large numberof individuals to be continually monitored over a large area. It couldbe combined with on-site biometric devices.

In the soldier and pass holder scenarios, a body sensor is attached toan individual, the individual is carrying a handheld device, and thehandheld device talks to the body sensor. If the body sensor is removedor the body sensor detects a trauma, the handheld device records thisevent in such a way that the handheld device cannot be later reverseengineered to omit the detection of this event. The body sensor, thehandheld device, and the installation of the Secure Network assures thatwhen the system communicates with the handheld device it can determinewhether the individual carrying the handheld is alive and can authentichim or her.

Before the individual goes to the battlefield or applies for admissionto a facility or event, the individual must be properly set up with abody sensor and a handheld device in some secure and known environment.This could be an assembly of soldiers before being dispatched to thebattlefield or some type of telephone verification or other procedurefor pass holder admittance.

Once the individual has the body sensor and the handheld device, it isthen necessary to locate the handheld device in three dimensional space.One technology for doing this is to detect individuals passing throughfixed screening devices, and querying the handheld device. The screeningdevices would talk to the handheld devices through some appropriateinterface. The fixed screening devices would be appropriate forperimeter protection and building access. As an example, a technologyexists for communicating via florescent lights (see e.g.www.talkinglights.com). There is also a technology for illuminatingdevices with light and receiving a response via retroreflection. Thereare numerous developments of this technology. The point is that once anindividual, equipped with the handheld and his or her body sensor, islocated in three dimensional space, we can be assured that theindividual is authentic and has not been replaced by the enemy.

This system of securely identifying individuals could be furtherexpanded by developing a network of individuals with body sensors andhandhelds inside vehicles which communicate via wireless with remotesensors. This could be used to form a network that would authenticatevehicles entering a facility by authenticating the vehicle and itspassengers. There can be a problem of detecting a rogue unauthorizedindividual inside a vehicle which is analogous to finding a roguecontainer inside a container pile on a ship.

FIG. 1 is a block diagram of one embodiment of a secure detection systemnetwork in accordance with the present invention, applied to theshipping container scenario. In this embodiment, the secure detectionsystem network implements the Secure Network in the context ofprotecting one or more shipping containers, such as shipping container100. Such shipping containers can be transported by any number of means,e.g., ship, airplane, train, or truck. The secure detection systemnetwork includes remote nodes, monitors, and servers, and optionallyrobots, which all form nodes in the Secure Network.

A remote node, such as remote nodes 102, 104, 106, 108, includes acomputer processor and storage having an agent module loaded thereonthat causes the remote node to act as part of the Secure Network. Inthis embodiment, each remote node 102, 104, 106, 108 includes a wirelesscommunication interface. The various communication paths are shown aswireless paths by dashed lines between the nodes. As shown, each node isconfigured to communicate with each other node, though it is notessential that this be the case. Also, the remote nodes are configuredto communicate with at least one monitor 120, robot 130 (if included),and server 140.

Each remote node is coupled to a variety of detectors capable ofdetecting illegal conditions, such as atomic bombs, chemical andbiological weapons, human beings and shielding materials. In FIG. 1,detector 122 is coupled to remote node 102, detector 124 is coupled toremote node 104, detector 126 is coupled to remote node 106, anddetector 128 is coupled to remote node 108. Remote nodes 102, 104, 106,108 are able to receive from the detectors signals indicative of thepresence or occurrence of such illegal conditions with respect tocontainer 100. Preferably, the detectors are also configured to detectthe occurrence of suspicious activities directed against the remotenodes 102, 104, 106, 108, detectors 122, 124, 126, 128, or container110.

Preferably, each remote node is housed within a tamper resistant box.Detectors may be included in the same box. Each remote node housed intamper resistant box can be coupled to container 110 via brackets 112,114, 116, 118. The set of detectors may also include detectors capableof detecting attacks against the tamper resistant box. Generally, thevarious detectors discussed herein are known in the art, so notdisclosed in detail herein.

The phrase “tamper resistant”, as used herein, refers to a structurethat has been hardened against tampering, including reverse engineering,to the extent possible under the state of the art of relevanttechnologies. Such technologies can include physical measures anddetection means, including electrical, magnetic, infrared, logical orother sensory means of protection or detection as well as softwaremethods. The resistance to tampering can be increased by variousstrategies for deploying the nodes using the Secure Network. “Tamperevident” is considered to fall within the scope of the “tamper proof” or“tamper resistant” concept, in that the tamper resistant box may includemeans for detecting attempts by an enemy to tamper with it. Ideally, thetamper resistant box will detect tampering before the enemy realizesthat the detection has been made. In this case, the box can also act asa decoy. Tamper proof refers to an ideal which, theoretically at least,is unattainable, thus use of “tamper resistant” is generally moreaccurate.

A robot 130 may optionally be included, and can take the form of aportable computer platform. The robot 130 could, for instance, take theform of a handheld device, remote controlled device, or pre-programmedmobile device. When included, the robot 130 forms part of the SecureNetwork and is configured as a monitor node. Accordingly, the robot 130can perform auditing activity, such as counting and identifyingcontainers that either do or do not contain remote nodes. For example, arobot could be deployed before entry and/or exit of a port.

As a node in the Secure Network, robot 130 executes an intelligent agentthat configures the robot as a node capable of auditing other nodes inthe Secure Network. In a wireless setting, robot 130 includes a wirelesscommunication interface to enable communication with other wirelessnodes in the Secure Network.

Like the remote nodes 102, 104, 106, 108, a robot 130 can be enclosed inits own tamper resistant box. In such a form, robot 130 includesdetectors suitable for detecting attacks against its own tamperresistant box.

A monitor (or monitor node) 120 forms part of the Secure Network.Monitor node 120 includes a computer processor and storage, and isconfigured to host and run an intelligent agent capable of configuringthe monitor, including installing any downloaded software and files. Inthe wireless setting, monitor 120 includes a wireless communicationinterface that enables it to communicate with various servers (e.g.,server 140), other monitors, robots (e.g., robot 130) and remote nodesto perform auditing of the Secure Network.

The monitor node 120 may also be configured to detect suspiciousactivities directed against it. As with the robot and remote nodes, themonitor node 120 may also be enclosed in its own tamper resistant box.If housed within a tamper resistant box, monitor node 120 may also beconfigured to couple to detectors capable of detecting attacks againstthe tamper resistant box. Unlike remote nodes 102, 104, 106, 108, themonitor node 120 does not directly couple to container detectors, unlessrequired as part of its auditing function. Rather, the monitor node 120provides an auditing function with respect to the remote nodes 102, 104,106, 108 themselves, and can also be configured to audit other nodeswithin the Secure Network. Therefore, the monitor node 120 can receiveand process data from remote nodes indicating an illegal condition orattempt to compromise the Secure Network.

Secure Network server 140 is a computer, possibly located inside asecure United States government facility or a security managementfacility, which provides overall management of the Secure Network. TheSecure Network server 140 is configured to generate software and datafiles, including initial encryption keys, for each remote node andmonitor node. The software and data files (and encryption keys) arespecifically generated for each node. Each node can be given an IPaddress, which provides a means for the Secure Network server 140 toaccess the nodes via, for example, the Internet and to distribute thecorresponding intelligent agent modules (or agents), software and filesto each node. For a given node, the agent installs the software andfiles, allowing the node to enter the Secure Network. In the event thatthe Network server 140 is housed within a tamper resistant box, then theSecure Network server may also include detectors capable of detectingattacks against the tamper resistant box.

In the preferred embodiment, the present invention enables an “activedefense”. An “active defense” presumably goes beyond preventing an actthat is already underway but either prevents other attacks fromoccurring or at least identifies a specific attack very early on, beforethe enemy knows it has been discovered. An active defense contemplatesthe possibility of capturing or destroying the attackers, includingpersons who are planning or managing the attack. Monitoring attempts toattack Secure Network nodes provides an active defense.

As is shown in FIG. 2, a plurality of, if not all, shipping containerson a single vessel could include some number of remote nodes. Thepresence of one or more remote nodes in each container being shipped ina vessel could be made a condition for that vessel entering US Ports(e.g., where the vessel is a ship) or crossing a US border (e.g., wherethe container is being transported on a truck body or by rail). In FIG.2, eight containers are shown loaded on a vessel 200. For a first set ofcontainers, container 202 includes remote nodes A-D, container 204includes remote nodes E-H, container 206 includes remote nodes I-L, andcontainer 208 includes nodes M-P. For a second set of containers,container 212 includes remote nodes Q-T, container 214 includes remotenodes U-X, container 216 includes remote nodes Y-BB, and container 218includes nodes CC-FF.

The containers can be examined efficiently by the onboard monitor 220through communication with the remote nodes of each container, while thecontainer is in transit from the foreign point of origin. Suchmonitoring can determine if any of the containers are storing suspiciousmaterials or are the target of suspicious activities. The remote nodesreport to and can be queried by either monitors or servers. Thecommunication path between a remote node and monitor 220 can be director via other remote nodes. And the path between remote nodes and server240 can be direct or via other nodes.

For example, path 222 shows that remote node B can communicate withmonitor node 220 via remote nodes E-F-H-N-P. This path can be continuedto server 240 via path 242, thereby establishing a path between remotenode B and server 240, via remote nodes E-F-H-N-P and monitor 220. Ofcourse, path 242 could also represent communications between monitor 220and server 240, independent of communications from any remote nodes.Other paths may also be formed for remote node B to communicate withmonitor 220. As an example of direct communications, remote node DD isshown communicating directly with monitor 220 via path 224. FIG. 2 alsoillustrates how a remote node can communicate directly with a server,here remote node FF communicates directly with server 240 via path 244.

FIG. 3 shows yet another configuration of containers on vessel 200. Thisis a stacked configuration. In a stacked configuration, it can bedifficult to maintain a wireless path between each remote node and themonitor node 220, server node 240 and, if provided, a robot (not shown).Also, there may be instances where not every container in the stackincludes a remote node. For instance, in FIG. 3, container 210 does notinclude a remote node. As an example, a communication path betweenremote node K of container 206 would likely not be a direct path, sincecontainer 206 is buried in the stack. Therefore, the path may have to gothrough other intermediate remote nodes, while avoiding container 210.Accordingly the path between remote node K and monitor node 220 includenodes L-J-S-T-AA-BB. Other paths could also be formed. To communicatewith server 240, the path may also include path 246 between monitor 220and server 240.

Through querying various remote nodes of containers, containers that donot contain remote nodes can be readily identified by monitor 220 or arobot prior to the ship arriving at its port (e.g., a US port) or thetruck or train arriving at a border (e.g., a US border). Shippingcontainers loaded on a ship can be examined while loading through anintermediary of a monitor 220 and after loading through the intermediaryof a robot.

The present invention addresses the problem of inserting detectiondevices into shipping containers in such a way that a determined,sophisticated enemy cannot defeat the system. In the foregoing figures,detectors and remote nodes are provided at the container. However, nodoubt, there will a number of potential strategies for defeating theinsertion of detectors and nodes which detect suspicious materials andactivities as described above. Such potential enemy strategies mayinclude:

-   -   1. Shield the suspicious materials or activities from the        detectors.    -   2. Defeat the communication interface so that the interface does        not report evidence of suspicious materials or activities        reported by the detectors.    -   3. Disconnect the detecting devices from the interface.    -   4. Surreptitiously load a container that contains an atomic        weapon but that does not contain detecting devices onto a        container ship.    -   5. Overcome the monitors so that they incorrectly report on the        status of the devices.

The difficult aspect of the environment is that the detectors, nodes andthe communications interface will be in the hands of the potential enemyfor some period of time, at least for the period of time necessary toload the container. Also, since the potential enemy is presumed capableof constructing an atomic weapon, the enemy must be presumed able toutilize other advanced technologies suitable for defeating thedetectors, remote nodes and interface. Also, if the enemy is conspiringwith a disloyal employee of the shipping company, the monitors and therobots could fall into enemy hands.

Of course, there are some advantages potentially available to the sideproviding the detectors, remote nodes and interface (i.e., thedefenders). For example, potential strategies and advantages fordefenders include:

-   -   1. Defenders can limit the time the detectors, remote nodes and        the interface are in the hands of the enemy, thereby limiting        the time available to reverse engineer the detectors or the        nodes.    -   2. Defenders will understand the defensive systems better than        the enemy. Defenders can maximize this advantage by making the        defensive terrain more difficult to understand, and by not        repeating the same defensive terrain. This means that reverse        engineering one interface will not necessarily be helpful for        reverse engineering the next.    -   3. Defenders can maintain important parts of the system        physically secure from the adversary.    -   4. Defenders can harden the physical protection around the        interface.    -   5. Defenders can use detecting devices which detect not only        suspicious material but also attacks against the communication        interface.    -   6. Defenders can use multiple communications interfaces and        detectors, which can continuously monitor one another, so that        if one is attacked one of the others can report the attack or        shut the system down.    -   7. Defenders have many opportunities to test the system.    -   8. Defenders have many opportunities to employ robots which can        be externally controlled from remote secure locations.    -   9. Defenders have the ability to continuously monitor each        remote node from the moment a shipper begins loading the        container until the container arrives at its final destination.    -   10. Defenders have the opportunity to mount an active defense        such that an enemy can be detected before the enemy realizes it        has been detected, thereby allowing the defenders to perform to        covert surveillance of the enemy's infrastructure.    -   11. Defenders can implement orthogonality to significantly        reduce the possibility of imposters gaining access to        containers, detectors, remote nodes, monitors, or robots.    -   12. Defenders can use a secure stage during which they can        configure the battle terrain to the defenders' advantage.

A secure detection system network in accordance with the presentinvention is particularly suited to maximizing these advantages for thedefenders. The capabilities provided by such a system which are relevantto maximizing the above strategic advantages for the defenders arediscussed below.

Generating network components, rapidly installing these components, andauditing the components immediately after installation provides a greatdeal of security. This generation/installation/audit capability can beutilized to limit the time a remote node is in the hands of anadversary, since this process is so highly automated, and the ability todynamically configure the remote node presents unknown terrain to apotential attacker.

Strobed encryption allows for exchanging encryption keys every fewseconds between nodes in the Secure Network. This capability can beexploited by constructing a system of nodes so that they can all strobewith one another and each can check on whether the other is beingattacked. This makes reverse engineering more difficult because thetarget is continuously changing encryption keys. In this context, if theinformation is communicated outside to monitor nodes, informationpreviously sent, even if it could be decrypted, is almost useless to apotential enemy. So, breaking one key does not help break the next. Thetime advantage between detection of an attack and an enemy's realizationthat detection has occurred represents an opportunity to mount a defenseaimed at penetrating an enemy's infrastructure.

The Secure Network can be used to rapidly configure ad hoc networks suchthat several remote nodes inside a container can be securely linked toone another and to other nodes such as, (a) to a shipboard monitor whichwill monitor the remote nodes in all of the containers on board, (b) topossibly a monitor which will communicate with the remote nodes whilethe container is being loaded by the adversary, (c) to possibly nodes inother containers, and (d) to possibly a robot which will count thecontainers before the ship is ready to leave port.

One possible application of this embodiment of the present invention isdiscussed below. We will assume the following organizations areinvolved: (a) a US Coast Guard Control organization located in theUnited States in a secure location; (b) a shipping company, located in aforeign country, which is known to and certified by the Coast Guard; and(c) a shipper (or seller/distributor) who will load the container withmerchandise (or cargo). We assume that the shipper is hostile. We assumethat the shipping company is disposed to be cooperative, that is, theshipping company is a substantial, recognized business which has astrong financial incentive to prevent a nuclear attack on the UnitedStates perpetrated through the intermediary of one of its containers.However, we may assume that the shipping company has some disloyalemployees who personally are hostile to the United States.

We will assume a requirement that a container that does not contain anapproved secure detection system is not allowed to enter the UnitedStates. Shipping companies who refuse to comply would not be allowed toship containers into the United States, whether through US ports oracross US borders. Shipping companies who want to comply will registerwith the US Coast Guard for example. As a precondition of being allowedto register, they would agree to undergo a background check, thesimplicity or intensity of which would vary company by company.

A description of how the system could operate under this scenario is asfollows. The remote nodes and monitors are provided to shippingcompanies. The remote nodes and monitors are manufactured and deliveredin a tamper-resistant state for installation in containers bound for theUnited States. The remote node could include the detectors within itstamper resistant box. The nodes could come in different classes,depending upon the type of detectors with which the remote node isconfigured to interface. The class, nature, type, quantity, andcapabilities of the detectors configured to couple to a remote nodeshould remain classified and known only to the server node.

The shipper orders one or more containers. For example, the shipperneeds a container to ship a particular product to the United States. Theshipper arranges with the shipping company for delivery of a containerto the location where the shipper will load the container. The shipperand shipping company agree on details such as the size of containerdesired, when the container will be delivered, the contents of thecontainer, when the container will be ready for pickup, destination,likely weight and so forth.

The shipping company enters an order with Coast Guard. The shippingcompany is registered with, for example, a container control systemestablished by the Coast Guard. Using a computer and communicating viathe Internet, the shipping company connects to the Secure Network servernode and inputs the appropriate information regarding the request for acontainer received from the shipper.

The shipping company initializes remote nodes and monitors to be used bythe shipper via the Secure Network server. For example, on the day thecontainer is to be dispatched to the shipper, the shipping companyassigns a separate IP address to each of some number of remote nodes,perhaps four, and a monitor node, and also assigns a receptacle numberto each remote node assigned to the container.

The server node identifies the remote nodes that should be placed in thedesignated container based on the nature of the cargo to be shipped, theremote nodes known to be in the inventory of the shipping company, andother factors such as, perhaps, the reputation of the shipper, thecountry of origin, and so forth.

A shipping company employee then couples the remote nodes and monitornode to the Internet, enters the respective IP addresses and receptaclenumber for each remote node and requests initialization from the server.

The server generates software and data files necessary to securelynetwork the remote nodes and one or more monitors with the server into aSecure Network, as previously discussed. Additional random procedurescan be introduced into the software so that no two remote nodes orsystems will appear identical to an enemy attempting to reverse engineerthem. The server will also randomly generate initial keys for use whenthe remote nodes or monitors connect with one another via the SecureNetwork.

The server will query each of the remote nodes and monitors to checksystem integrity. The remote nodes and monitor will all have serialnumbers in their processors, which previously will have been registeredwith the server. The server will then automatically download and installsoftware on the remote nodes and monitors which are still in theshipping company's possession or control. When the installation iscomplete, the remote nodes and the monitors will connect to one another,and immediately begin strobing the encryption keys used between eachpair to exchange messages. Strobing is discussed in detail in AppendixG.

The shipping company can perform an orthogonal audit, as more fullydescribed in the Appendicies hereof. The installation can, for example,be orthogonally authenticated perhaps by the server's downloading arandomly generated number to be displayed on the screen of shippingcompany's office computer and then by placing a telephone call toshipping company's office and having the number on the screen enteredthrough the telephone key pad.

The authentication is valid even if the shipping company employeesupervising the installation is personally hostile to the United Statesor is working for an enemy. This auditing procedure is in conformitywith the methods disclosed to audit a node after installation in theSecure Network.

The shipping company installs remote nodes in the container, preferablyin numbered, tamper resistant receptacles, perhaps in the four diagonalcorners of the container, and delivers the container to the shipper. Itwould be appropriate to perform another auditing procedure when theremote nodes have been inserted into their appropriate receptacles. Thefour remote nodes will continue to send messages to one another and tostrobe encryption keys with one another. The remote nodes optimally willalso remain in contact with a monitor, which can remain in the shippingcompany's control, and which will remain in contact with the server.

An optimal configuration would enable any remote nodes to detectattempts to tamper with it or to remove it from the receptacle intowhich it has been placed. Any suspected tampering could be detected bythe remote node and communicated to other remote nodes or to the monitoror monitors to which the remote nodes are connected.

The shipping company then delivers the container to the shipper. Theremote nodes and detectors are installed and the remote nodes continuecommunicating with one another and with a monitor in the shippingcompany office. The remote nodes should remain connected to a powersource. If they are disconnected from the power source this willrepresent a system violation. As an example, the remote nodes could usesome type of a rechargeable battery. Containers provided with powersources have been used in global commerce for many years. These powersources could also provide power for remote nodes.

The shipper loads the cargo into the container. This is a vulnerablesituation because the remote nodes are potentially under the control ofthe enemy at this time and must withstand attacks designed to destroy,deceive, or reverse engineer them. However, if any remote node candetect tampering, it will communicate with the monitor and could be shutdown. If tampering is detected, the container will preferably not beloaded on the ship without human inspection, and the matter shouldescalate so that appropriate police, military, and forensic activitiescan be initiated with the objective of capturing and prosecuting thepersons who performed the tampering.

However, if the tampering can be detected without the shipper beingaware that it has been detected, additional measures may be appropriate,namely the provision of additional surveillance and intelligenceresources at the site where the container is being loaded andconceivably at the site where the ship will be loaded and at the officesof the shipping company. This would represent an active defensestrategy.

Depending on cost and available technology, it would be possible toinstall various scanning devices in the remote nodes so that the loadingof the container could be viewed and monitored. These devices could beimportant sources of intelligence.

Once the container has been loaded and locked by the shipper, it will bepicked up by the shipping company, delivered to the port of departureand then loaded onto the ship.

Prior to loading, the monitor will communicate with the remote nodes inthe container, and verify (a) that the remote nodes are in place andhave not been tampered with and (b) that they have not detectedsuspicious materials or suspicious activities. Software on the monitorcan also compare the weight of the presumed cargo of the container, andthe actual weight of the container. Containers that exceed theirexpected weights by some predetermined amount will be subject to openingand visual inspection.

If included, a robot can be tasked to examine the ship before departure.After the ship is loaded and immediately before departure the robot willtraverse the ship to inspect each object that could be a container, andverify that each such object is a container equipped with appropriateremote nodes.

The purpose of the robot is to avoid a situation where terrorists,working in concert with port employees and/or employees of the shipper,somehow smuggle an additional rogue container on board. Since this roguecontainer would not have any remote nodes inside, there would be no wayfor the monitor to know it is on board or what is inside it.

Prior to departure, the shipping company can install the monitor node ina tamper-resistant holder on the ship. The monitor will communicate withat least one remote node in each container and remain in contact witheach container throughout the voyage to the United States. At the sametime, the monitor onboard the ship will communicate with the robot (ifany), and obtain a count of the number of containers on the ship and areport as to the existence of any containers on the ship that lackremote nodes. Containers lacking remote nodes can be unloaded from theship and refused shipment until they have been opened and inspected bythe shipping company and the port authority. If they are determined tobe legitimate containers, the shipping company will install properlyauthenticated remote nodes before permitting the containers to be sealedand shipped.

After performing the inspection, the robot can be removed from the ship,reinitialized, and be used to inspect the containers on another ship.

A robot can also be used to examine a ship before entry into a US port.When the ship reaches the US port, the Coast Guard will be able tocommunicate with the monitor on board the ship and will be able toverify that the ship is composed entirely of containers with remotenodes and that no sensor has detected improper materials. The robotcould also re-examine the ship to determine that all containers haveremote nodes, that is, that a rogue container has not been loaded onboard during the voyage.

One method might be to have a robot that remains on board the ship. Therobot could be reinitialized automatically and could perform itsinspection without the ship having to be boarded by the Coast Guard. Asecond method is for the Coast Guard to board the ship and bring a robotwith them. The robot would be initialized as a node and authenticatedwhen it was on board the ship.

A shipping company could already have appropriate robots or controls onboard so that the functions performed by an robot could be performed bycontrols already on board the ship. In this case, it would beappropriate to integrate the monitor with on board system controls in anappropriately secure manner.

If any remote nodes have found suspicious materials, the correspondingcontainers would need to be inspected. Containers without remote nodes,or with remote nodes that have ceased to function, will need to beinspected.

In cases where a ship uses holds to store loose cargo, one or moreremote nodes could be placed inside such holds. The hold could betreated as a container. The hold is typically bigger than a container,although individual items of cargo in the hold are usually smaller thanitems loaded into a container, and, therefore, would generally be lesscapable of providing shielding against detection of suspiciousmaterials.

Containers seeking to enter the US by truck or by rail can be held tothe same requirements. That is, they could be required to contain remotenodes which could be examined by a monitor prior to being permitted USentry.

The remote nodes can be manufactured and shipped to include detectors intheir tamper resistant containers. What detectors are actually locatedin a specific remote node should remain highly classified, since thatinformation would aid those interested in defeating the nodes. Thedetectors that are introduced into any specific container should dependon the cargo that the shippers claim will be shipped. The decision as towhich remote nodes should be installed into a container should be madeby the server based on information which only it has.

Given a specific set of detectors in a remote node, the values which thedetectors will look for should be dynamically configured by the serverimmediately before the container is shipped. This is essentially an armsrace, wherein as the enemy becomes more sophisticated in ways ofshielding bombs the detectors are improved to overcome the shielding. Itis assumed that whatever the current state of detection and shieldtechnology, that detection can be improved by getting detectors insidethe container. Also, deploying an inside-the-container detection systemprovides an additional layer of protection that augments and backs upwhatever detection is possible from satellites or otherout-of-the-container scanning methods.

To the extent that these detectors could be mounted on chips and builtinto a circuit board, more detectors could be deployed moreinexpensively. Indeed, there is some discussion in the literature as tothe need for scanning large areas of the earth with broad area passivesensors and then focusing on potential targets with narrowly focusedactive sensors. Presumably, if one could get close enough to thepotential target, the need for broad area sensors would be lessened andthe detecting ability of more narrowly focused sensors would be greater.

For example, considerable protection could be achieved if each remotenode contained one or more Geiger counters and/or other detectors andpossibly a way of detecting if the remote node were moved from itsbrackets. Just beating this system would require time and design on thepart of potential enemies. Buying time is important because in themeanwhile perhaps the bomb manufacturing plant could be discovered anddestroyed. Perhaps better sensors could be developed which could thendefeat any improved shielding the enemy had developed. In any event, theSecure Network provides a significantly higher degree of security thanmight otherwise be available

One of the strategies of the secure detection system is to limit theability of the enemy to experiment with the detectors. A second,somewhat related strategy, is to detect an attack on the remote nodesbefore the enemy knows that it has been detected, thereby pinpointingthe existence and location of enemy facilities. It is possible using asystem that includes the Secure Network with detectors to detectattempted enemy attack before the enemy knows that his attack isdetected. This actually represents an active defense.

Detecting an enemy attack before the enemy is aware that the attack hasbeen detected has many important possibilities, such as militarilyraiding the location where the container is being loaded, addingadditional intelligence gathering capability to that particular site andso forth. Of course a shipper who attempts to attack a remote node or tosurreptitiously ship weapons should not again be allowed to shipcontainers to the United States.

The detecting strategy can be improved to correspond to the cargo whichthe shipper claims will be present. The system proposed in thisinvention is particularly well suited to dynamically modifying thedetection strategy to suit the proposed cargo. In the first place, thedecision as which remote nodes are selected to be included in thecontainer can be dynamically made, by the server, at the moment theremote nodes are prepared for subsequent insertion in the container.Secondly, the detection strategy that will be used by the remote nodes,given a specific set of detectors, can be dynamically configured at thismoment. The selection of the remote nodes and detectors, and theconfiguration of the detection strategies, can be made on the basis ofinformation available only to the server.

Certain cargoes might be of such a nature that it would be impossible todetermine whether a bomb was hidden inside, in which case these cargoeswould require manual inspection. Examples of such cargoes could be thelegitimate shipment of nuclear materials or legitimate shipment ofnuclear shielding materials.

It is also potentially important to assure that the detectors remainlocated at both ends of the container rather than, say, being moved toone corner. But, this can be a function of the detectors' range anddensity of the cargo loaded in the container. The detectors may belocated in the same box as the remote nodes, or in other embodimentsdetectors could external to whatever box holds the remote nodes. Thereare a variety of methods of determining where the remote nodes are inthe container and also of detecting any attempts to relocate them whileunder the control of the shipper. However, it is important to detectmovement of the remote nodes from their original position. In the firstplace, movement of the detectors can be evidence of an attempt to attackthe remote nodes, particularly when they are in the same tamperresistant box. Secondly, movement of the remote nodes may impair theability of any enclosed detectors to detect suspicious materials.

The present invention is structured so that actions taken by humanbeings can be independently verified by other means. Since the systemdoes not rely on any human action that cannot be separately verified itcan therefore be orthogonally secure.

While the foregoing has described what are considered to be the bestmode and/or other preferred embodiments, it is understood that variousmodifications may be made therein and that the invention or inventionsmay be implemented in various forms and embodiments, and that they maybe applied in numerous applications, only some of which have beendescribed herein. As used herein, the terms “includes” and “including”mean without limitation. It is intended by the following claims to claimany and all modifications and variations that fall within the true scopeof the inventive concepts.

APPENDIX A Secure Network & System Overview

A Secure Network in accordance with the present invention is composed ofnodes, which can be objects that run as threads and which are capable ofsecurely connecting to other nodes and of interfacing to a wide varietyof other computer executables and libraries running on Windows or UNIX.

Strobed encryption is the procedure for dynamically changing encryptionkeys every 30 to 60 seconds, for example. The details of oneimplementation of strobed encryption are provided in Appendix G. Theparties begin with randomly generated startup or initial keys, which arehidden from everyone, including the parties themselves. By contrast, keyexchange protocols such as EKE or kerberos, start with only a rememberedpassword and have no mechanism for changing keys during a particularsession. Strobed encryption in accordance with the present inventiondepends on other technologies of the Secure Network, such as automaticnetwork generation, automatic installation, orthogonal authentication(see Appendix B) and audit, and data packaging (see Appendix C). TheSecure Network uses only encryption primitives that are public,standard, and tested. New encryption primitives can be added as theybecome available.

Packaging, as used in the Secure Network, is an object-orientedframework for creating and compressing packages suitable for use overTCP/IP. The packaging framework include an Item class, which allowsderived objects to model virtual any data format, and to applycompression on a field by field basis. Items and packages can beinserted into and extracted from packages and packages can be insertedinto warehouses, which are disk resident files. The Secure Network usesits packaging methodology for general data transport and for storage andtransport of encryption keys.

The Secure Network has a network generation program, which automaticallygenerates configuration information needed to install a node. Thisprogram randomly generates the startup keys for all nodes. These keyswill strobe immediately after the first connection. The networkgeneration program also builds the executables and dynamically embedsrandomly generated keys into the executables. See Appendix D.

The Secure Network has an installation procedure which permits automaticinstallation of an entire network or parts of a network and allows fororthogonal audit and authentication of every network node, discussed inAppendix E.

Nodes in the Secure Network connect to other nodes using TCP/IP. Nodescan directly connect to some arbitrary number of nodes. By connectingnodes going through intermediate hops, an arbitrarily large SecureNetwork can be constructed. As an example, the node can be modeled inC++ as a class derived from an node thread class. The node class isinserted into an executable or a COM object by means of a pointer. Thenode class has an embedded package, and this package contains theinformation generated by the generator which allows the node to connectto other nodes.

The process that manages a node can do other things. For example,database servers can be nodes. A process that runs a browser can be anode. Intermediary routers that are used in a massive Secure Network canbe nodes. (See Appendix F). The network diagram of the massivelyscalable Secure Network (see FIG. 4) shows some 27 different nodes. Eachnode has a different number, which is located in the lower right handcorner of the box on the diagram.

The server has a generator program, which, using a template, suppliesall of the values needed for the various nodes in a Secure Network toconnect to one another. The formal, exact definition of a node is that anode is an object created by the generator, which has the characteristicof being able to connect to other nodes. To define the relationshipbetween a process and a node, at least one process is required to managea node. Although, a process could manage more than one node.

There appear to be three unstated implicit assumptions in the presentsecurity system practice and the current security literature that arenot followed in the Secure Network system. These assumptions are (1)that one cannot look to verify the identity of the other side; (2) thatone cannot frequently reinstall the network; and (3) that one cannotfrequently rebuild the network or the software. It would appear thatthese assumption have constrained approaches to the security problem soas to make the solution more, rather than less, difficult. Usually, ofcourse, constraining a problem leads more readily to a solution, but inthis case it appears to be the other way around.

Assumption One: No looking. The first assumption is that, whenauthenticating humans, one cannot go and “look” to see and verify theidentity of the person at the other end of the connection. Usingorthogonality the Secure Network system goes and “looks” (usingbiometrics, physical facilities, human audit, telephones, cross checkingwith other databases, and business procedures) to “see” that the personon the other end of the connection is actually who he/she claims to be.

Corollary to Assumption One: Only verify once per day. There appears tobe a corollary to the “no looking” assumption, i.e. that once you haveverified the person on the other side, it would be unseemly to verifyher again, at least that same day. As we have indicated, Secure Networksystem is capable of (and interested in) verifying that person'sidentity many times per day.

Assumption Two: No reinstallations. Assumption two, which the SecureNetwork does not accept, is that installation is something that happenedin the past and will not happen again for many months. Since theprocedure can be automated and because it is easy to accomplish, theSecure Network is designed on the principle that critical applicationswill be installed and orthogonally authenticated frequently, e.g., everymorning. The principles of the orthogonal authentication have beenoutlined herein, as have the principles of automatic installation.

It may be argued that reinstalling critical applications would overtaxcorporate computing resources. However, a large organization typicallywill have most of its employees working during a single daytime shift,and it will have computers available to support that work during thatshift. During off-shift hours, under this assumption, unused computingresources are idle. The Secure Network can install a crucial applicationin a few seconds, so there is no significant impact to a large network.

It may be argued that daily reinstallation would be expensive. However,automatic reinstallation every morning saves organizations time andmoney. Conversely, manual installation is an inconvenient, timeconsuming, expensive, insecure, and error prone process. A new manualinstallation is usually required for each new client for a major system.A manual installation might cost, for example, $10,000 for a systeminstalled in a foreign country. By assuming that all critical systemswill always be automatically installed, a company would eliminate everdoing a manual installation, and thereby avoid the costs of manualinstallations.

Another important aspect of machine generated automatic installation ofapplications is that it takes installation out of the hands of systemadministrators, who, if they are corrupt, may install software which isnot allowed. While reinstalling, the Secure Network installationprocedure will destroy possibly infected examples of its own software.While reinstalling, the Secure Network will check for other examples ofunauthorized software.

Assumption Three: No rebuilding. A final assumption, not accepted by theSecure Network, is that the code build and network configuration issomething which happened in the past and will not happen again for manymonths. If frequently reinstalling, the software and network can berebuilt at the same time. The advantage of rebuilding is that the SecureNetwork can randomly generate new keys and embed these keys in theexecutables. Also, the Secure Network can build new network connections,so can randomly generate keys for each connection, and randomly changeIP addresses.

As long as rebuilding, it would be appropriate to check the source codefor hidden back doors, and to verify that the source code has notchanged.

One effect on system design of abandoning these assumptions, i.e., onecannot verify identity by “looking” and can not reinstall or rebuildexecutables and networks daily, is that there is no need for digitalcertificates. By eliminating these assumptions, the Secure Network isable to provide each node pair with starting session keys and one-timepads in each direction. A one-time pad is advantageous because itrequires only an XOR to encrypt, which means that encryption is veryfast. After the initial startup, the Secure Network immediately changesall of these keys through strobed encryption.

APPENDIX B Orthogonal Authentication

Orthogonal authentication as implemented within the context of theSecure Network strengthens security by requiring multiple inputs fromunrelated sources as a constant check on security decisions. Orthogonalauthentication also eliminates the need for digital certificates andextends security procedures into the machine layer so as to mitigate thepotential failings of human guards.

As an example, the problem that digital certificates are designed tosolve is to determine whether the person on the other end of theconnection is Alice or some imposter such as Eve. Assume that Alice is aperson with sufficient authority to access computer networks that wouldenable her, if she were so inclined, to perform some devastating action,such as crashing a NASA mission, siphoning off enough money to put abank out of business, releasing nuclear materials to terrorists orloading weapons of mass destruction into a container. If we know Alicewell, and we do want to know Alice well or else we will not admit her toour network, we find that she has many characteristics that can beverified. Alice works somewhere, for example in Building 302 in AcmeComplex in Anytown, AnyCountry. Assume that Acme Complex has installed afacial scanner at the building entrance. If Alice has not successfullypassed through the facial scanner in Building 302 today, or if she hasalready left the building, a person on the other end of the connectionseeking access is not Alice.

Further assume that Alice works in Room 412, and that there is a handgeometry scanner at the entrance to this room. If Alice has notsuccessfully passed through the hand scanner in Room 412, the person onthe other end of the connection is not Alice.

Further assume that Alice has a specific workstation in Room 412, andthat she has a fingerprint scanner on her desk. If Alice's fingerprinthas not successfully passed that fingerprint scanner, the person on theother end of the connection is not Alice.

Further assume that Alice has a telephone on her desk. If we call thatnumber, and no one answers, or the person who answers does not pass avoice print scan, we can say that the person requesting access to oursystem is not Alice.

Further assume that Alice has a supervisor named Bob. If we contact Bobto verify that the person at Alice's desk is Alice, and he fails to doso within some period of time, we may conclude that the person at theother end of the connection is not Alice.

We can call Alice at various times during the day, and have Bob audither to determine that the person at the other end of the line is stillAlice. Also, we can be notified by the hand scanner when Alice leavesRoom 412 and by the facial scanner when Alice leaves the building. Wecan even require Alice to put her finger in the fingerprint scannerevery few hours. So we have a variety of strategies to verify that it isstill Alice who is at the other end of the connection.

These strategies are “orthogonal” in the sense that, for Eve to beaccepted as Alice, Eve will have to beat multiple unrelated systems andcorrupt unrelated people. All of these strategies are more powerful andreliable than the fact that at some point in the past Alice has beenissued a digital certificate. First, the fact that a digital certificateis properly presented does not conclusively prove that Alice is at theother side of the connection. The certificate could be stolen or phonyor someone else could be sitting at the computer where the certificatewas installed.

Second, digital certificates can be stolen. Third, if someone can stealthe secret key, the digital certificate can be remanufactured at will.Since the key can be stolen through copying, the theft of the key maynot be detected for months. Fourth, a digital certificate has a lifetimeand therefore a vulnerability of approximately six months, during whichtime it could be stolen or broken. A security device with a long periodof vulnerability is not an optimal situation. For example, the digitalcertificate has such a long lifetime that a terrorist could defeat thedigital certificate in some way and still have time to defeat anothersystem such as a biometric device. Fifth, digital certificates are oftenissued by third party authorities, which means the organization has torely on the security of a third party it does not control.

With the exception of Bob's audit of Alice, the orthogonalauthentication procedures do not depend upon on-the-spot decisions madeby human beings. The procedures described above will work as well at4:00 pm in the afternoon, when humans become tired, as they worked at8:00 am in the morning, when humans are alert. The procedures will workthe same way whether Alice is a clerk or is the CEO. Bob is primarilycalled upon to perform the audit. His only “decision” is determinewhether the person sitting at the desk is Alice or not Alice.

APPENDIX C Data Packaging

The Secure Network system sends Secure Network packages directly overTCP/IP. A package is an object which will turn itself into a stream andunpack itself from a stream. A stream is a set of bits that can be sentover TCP/IP. The Secure Network packaging software also contains an Itemclass. Objects derived from the Item class can model any data format.Items can be inserted into and extracted from packages. Through the useof virtual functions, a package can insert and extract a derived Itemwhich it has never seen before.

The advantage of the Item class is that one can develop specific dataformats for specific purposes, and also that compression can be appliedat the Item level for data that is highly repetitive. Items can containlongs, integers, bytes, bits, strings, and streams. Packages can beinserted into and extracted from packages. Packages have their owncompression methods. Keys are typically generated inside Items asstreams; items are inserted into packages, the package is compressed,and then encrypted with another key. No keys are stored in the clear.Keys are generally not stored on disk, and certainly not on the samedisk where the files they encrypt are located.

The Secure Network can contain warehouses. A warehouse is a file intowhich packages can be inserted and extracted. Packages are alwayscompressed and usually encrypted. Warehouses permit fast searches forpackages.

The compression ratio for a package depends on the type of data that isinserted. Keys and random numbers are changed but not made smaller aftercompression. Certain other types of data can be compressed up to 10times. Packages are also used to send application data and for keystrobing. Any data loss or alteration will render the entire packageunusable and unrecoverable and therefore immediately noticeable.

APPENDIX D Network Generation

The Secure Network generator generates all of the executables and datafiles necessary to start a process at a particular IP address, andusually executed on the Secure Network server. Most of the data filesare Secure Network warehouses, which store packages encrypted with ahard key, just randomly generated, which is embedded within theexecutables.

The Secure Network generator generates network parts from a template.The generator is critical for implementing strobed encryption and forextending the Secure Network system back through system design, testingand build. By putting the template and the generator under orthogonalaudit control, control over who can design, build, test, and install agiven network and who approves the design is possible. As part of eachbuild, the source code is checked for network calls other than throughthe Secure Network API and for hidden back doors by other methods.

By generating network parts immediately before the node is installed,the Secure Network can provide start up keys that are only minutes old.If 10,000 employees in a large facility were due to access the computerfacilities at 8:00 AM, a portion of the network generation might occurhalf an hour earlier. The last operation to occur would be thegeneration of the startup keys, which could be arranged to be withinminutes rather than hours of the time a node was downloaded andinstalled.

APPENDIX E Network Installation

Network installation means delivery of software and data files to aparticular computer, starting a process to manage each Secure Networknode on that computer, and providing some type of orthogonalauthentication when the nodes have begun to connect. Nodes know all ofthe other nodes to which they are allowed to connect. When a node isstarted by a process, it automatically connects with all other allowablenodes with which it can establish a TCP/IP connection, and immediatelybegins strobing encryption keys. A node has available to it an initialset of encryption keys for each allowable connection.

Under the preferred installation procedure, the generator delivers thenode files to an Secure Network database, and then creates aself-executing file called an intelligent agent. The intelligent agentis downloaded to a target site or device. When it is run, it knows howto connect to the database, and downloads and installs the files fromthe Secure Network database. This has a number of advantages. Oneadvantage is that only the agent knows how to find the installationdatabase. This is a prevention against denial of service attacks. It isdifficult to conduct a denial of service attack against a database whichis hidden. Secondly, this design facilitates a single installation at aknown site. The agent knows where it is supposed to be, and if it is notwhere it is supposed to be, will not work at all. The database knowsthat a given agent is allowed to install only once, so if the same agenttries to install twice, something is wrong. This use of the agent mightalleviate the need to telephone a password to the target site, althoughperhaps it is not a bad idea to add this embellishment anyway.

Other safeguards are programmed into the Secure Network node that is thetarget site. A Secure Network node listens on a port/IP address whichhas been randomly generated seconds before the installation and which isnever made public; the node only accepts one connection to any othernode; it knows what it is supposed to be listening for and can determinea fraudulent connection immediately if the IP address is wrong and aftera single packet exchange, if the keys are wrong.

If a package is not correct (it cannot be decrypted, or afterdecryption, it cannot be inflated, or the check digit is wrong, or itcannot be unpacked), the package is rejected, and after a small numberof such packages, the connection is closed.

If despite these precautions, an intelligent agent were to be stolen,and installed fraudulently and it managed to connect successfully to theSecure Network server, the problem would become immediately apparent, ifthe installation needs to be orthogonally audited before any data ispermitted to pass over the new connection. Also, when the real nodeattempted to install, the problem would again be obvious because theSecure Network permits only one connection between nodes. The optimalprocedure is to generate the software for a node, install the node, andaudit it within a matter of minutes.

From the point of view of an employee, this procedure might be asfollows: the employee enters the building, passing through a biometricdevice such as a facial scanner or hand scanner; the employee enters hisor her work area, passing through another biometric device. The employeeturns on his or her computer, and uses a finger print scanner located onhis or her desk. A minute later the telephone rings and the employeeanswers it. The computer then admits the employee to the applications onthe network he or she is authorized to use.

APPENDIX F Massively Scalable Secure Network

The Secure Network can connect two nodes or dozens of nodes, or eventhousands of nodes. A portion of a massively scalable Secure Networkarchitecture is shown below in FIG. 4. Under the architecture, theSecure Network has two parts. One side is used for strobing and theother side for sending application data. The top level node, node 1,controls which side is used for strobing and which side is used forsending data. After a strobe on one side is completed, and after waitingfor some amount of time, node 1 sends messages so that the sidepreviously used for strobing is now used to send data, and the sidepreviously used to send data is now used for strobing. The amount oftime after completion of a strobe on one side is dynamicallyconfigurable and can be used to control the amount of resources used bythe system.

Under this architecture, any two nodes can be directly connected;otherwise nodes connect to nodes by going through various intermediaryhops. The design possibilities are very flexible. As a package passesthrough the hops, it is protected by end-to-end strobed encryption, inwhich the keys strobe between the node at which the package originatedand the node that is its destination.

Application nodes have been arbitrarily numbered in a sequencesbeginning with 32261 and 65441 in order to illustrate a hypotheticalnetwork of approximately 10,000 application nodes. Nodes at indenturelevels 0 though 4, that is all nodes with numbers less than 9999, arerouter nodes. The system has two separate networks of router nodes, asystem with positive numbers and a system with negative numbers. Nodesat indenture level five can communicate by sending packages througheither side of the network. Nodes can also be directly connected withone another. For example, 32262 directly connects with 65447.

APPENDIX G Strobed Encryption

Strobed encryption is a proprietary protocol which changes bothasymmetric and symmetric keys periodically. A strobe occurs at themoment a connection is made and then periodically thereafter.

The First Exchange

The first strobing exchange starts with a set of keys that are presenton network installation. Network keys and all files and software neededto connect to nodes are generated automatically by the Secure Networkgenerator and downloaded through one of the Secure Network installationmethods.

For example, suppose that we want to connect node A and B under theSecure Network. Go through the following steps.

-   -   1. Generate the software and software files necessary to connect        A and B, including symmetric keys needed to encrypt data between        A and B. At the present time, use a 448 bit Blowfish key and a        one-time pad of 2000 or more bytes. The generator randomly        generates two sets of keys, one set for each direction, for each        connection.    -   2. Download the software to the computers on which A and B are        to be located. (For this example we are assuming that A and B        are to be located on different computers). There are several        ways of doing this, as explained below.    -   3. Start the process managing the connection. The nodes will        automatically connect when the other side comes up assuming that        the two processes are connected via TCP/IP.    -   4. The two connections will immediately strobe all encryption        keys.    -   5. Audit the connection.    -   6. Continue to strobe every so often, maybe every 30 seconds.

The time between generating the network parts and the first connectioncould be only a few minutes. Immediately the node will be “audited” bybeing orthogonally authenticated in some way. If someone in the minuteor so between the generation of the A/B connection parts and the realinstallation of A and B, could steal all of the parts to make the Aconnection, and could install A, and spoof the IP address, and couldsomehow connect to B, and do the first strobe, when it comes time forthe actual A to connect, B will not connect a second time to A. It willbecome immediately obvious that something is wrong. The Secure Networkis designed so that only one connection between two nodes is possible.

Details of One Example of Strobed Encryption

This is an example of strobing as currently implemented.

Notation:

[ ] is a compressed ANGEL package;

{ } refers to a non-compressed ANGEL package.

(key) means encrypt what is to the right with key.

, a comma separates packages and items that have been inserted into apackage.

Index means an item that usually appears at the front of the payloadpackage.

A package is a C++ object which is capable of turning itself into astream suitable for transport over TCP/IP and of recovering itself froma TCP/IP stream. The package is also a container into which otherpackages can be inserted and from which other packages can be extracted.Items can also be inserted into and extracted from packages. Extractionfrom and insertion into a package is only possible if the containingpackage is non-compressed. Compressed packages can be inserted into andextracted from non-compressed packages. An Item is a C++ object which,through derivation, can model any data format. Packages have their owncompression methods. It is also possible to selectively compress data asthe data is added to an item.

Initial keys are first generated. In the preferred implementation, thefollowing initial keys are generated for encrypting packages sentbetween two sides of a TCP/IP connection. These keys are alreadyinstalled either by the installation program or by the previous strobe.Strobing involves randomly generating and changing these keys. Theinitial keys include:

e^(out) Blowfish 448 bit key to encrypt outbound packages

k^(out) one-time pad (2000 or more bytes) to encrypt outbound packages

e^(in) Blowfish 448 bit key to encrypt inbound packages

k^(in) one-time pad (2000 or more bytes) to encrypt inbound packages

Package encryption is also used. The package actually sent over TCP/IPis referred to as the payload package. This package consists of an Indexitem plus some number of other packages and items.

The Strobe sequence is as follows:

State0

State0 is the initial state after two nodes have been installed.

Node A

(1) Create keys:

s^(A) RSA secret key.

p^(A) RSA public key.

(2) Prepare a payload package and send it to the other side:

k^(out)(e^(out)([Index, p^(A)]))

This notation indicates that we have inserted Index, and p^(A) into apayload package, which is compressed, and then encrypted first withe^(out) and then with e^(out). We only use as much of k^(out) as isnecessary to XOR the payload package. If we used up k^(out) before wehave a chance to do another strobe, we are forced to commit thecryptographic sin of reusing some part of k^(out). However, we can avoidthis problem by making k^(out) large enough for potential needs.

Node B

Node B listens for a connection.

State1

Node A

Node A waits for a response from Node B.

Node B

(1) Extract p^(A) from the incoming data stream.

Node B will decrypt the incoming stream with k^(in), then with e^(in),then inflate the package. The package will now be {Index, p^(A)}, thatis, it is a non-compressed package containing two objects, an Indexobject, the public key from Node A, p^(A).

k^(in) and e^(in) are identical to k^(out) and e^(out) (used on theconnect side. If this is the first strobe, this match up will beperformed by the generator and the installation procedure. If this is anongoing strobe, this match would have been performed by the previousstrobe.

(2) Generate keys:

e^(B) Blowfish 448 bit key

s^(B) RSA secret key

p^(B) RSA public key

k^(B) One time key pad

(3) Make the payload package and send it to the other side.

k^(out)(e^(out)([Index, p^(A)([e^(B), k^(B), p^(B)])]))

(4) Install new keys as follows:

e^(B) as e^(out)

k^(B) as k^(in)

State2

Node A

(1) Decrypt the incoming package with k^(in) and e^(in), and extractp^(A)([e^(B), k^(B), p^(B)]).

-   -   Use s^(A) to decrypt [e^(B), k^(B), p^(B)]. Decompress and        extract e^(B), k^(B), and p^(B).

(2) Generate keys:

e^(A) 448 Blowfish key

k^(A) A one-time pad

(3) Install

k^(A) as k^(out)

k^(B) as k^(in)

(4) Make and send the payload package to the accept side

k^(out)(e^(out)([Index, p^(B)([e^(A), k^(A)])]))

(4) Install

e^(B) in e^(in)

e^(A) as e^(out)

Node B

Node B waits for a response from Node A.

State3

Node A

Node A waits for a response from Node B.

Node B

(1) Decrypt and inflate the payload package and extract p^(B)([e^(A),k^(A)]).

(2) use s^(B) to decrypt ([e^(A), k^(A)]).

(3) Install:

k^(A) as k^(out)

e^(A) as e^(in)

(4) Send a notification message to Node A.

State4

Strobing is complete, and nodes A and B may now begin transmitting datato each other encrypted using their respective k^(out), k^(in), e^(out),e^(in) keys.

Use of the One-Time Pad

In one embodiment, the Secure Network system can send a one-time padencrypted with other one-time pads and other session keys. If an enemywere to attempt a brute force attack on encrypted “text”, when the enemyhad guessed the correct method of decryption, the enemy would realizethat it had succeeded because the encrypted text would be plaintext andidentifiable as such. However, applying a brute force attack to recoveran encrypted one-time pad is more difficult because of the problem ofdistinguishing between a correctly and incorrectly decrypted one-timepad. The one-time pad is merely a sequence of random numbers. The“correctly decrypted one-time pad” can only be identified as correctlydecrypted when it is applied to some cipher text and produces somethingrecognizable as plaintext. Under the Secure Network system, the ciphertext that can be used to identify a correctly decrypted one-time padwill not be sent until later, so at the very least a brute force attackcannot be successfully implemented against the one-time pad until theplaintext is sent.

The problem that the one-time pad must be as long as the message isreal; however, we have methods for strobing the one-time pad on onechannel while sending messages on the other. For continuous encryptionthere is a danger of running out of the old one-time pad before a newone arrives. The one-time pad cannot be reused. However, manyapplications do not require continuous encryption, and it you want tosend a smaller amount of data, and you want to encrypt that data as fastas possible, a one-time pad is very rapid. For example, a radar looks atthe sky and sees nothing for days at a time. Suddenly something appears.

It would be appropriate to use a one-time pad to transfer that smallamount of critical data. Many applications, such as, for example, moneytransfer, send relatively tiny amounts of data interspersed withrelatively large periods of inactivity. For these applications, there isa relatively small danger of running out of a one-time pad.

Of course, if the application does run out of the old one-time pad, inthe time before the next one-time pad arrives, the application has touse other encryption methods and must not reuse the old one-time pad.

What is claimed is:
 1. A device comprising: a handheld devicecomprising: a first interface to a body sensor to sense biometricinformation from a body; and a second interface to a secure networkcomprising a server node to deliver to the handheld device an agentmodule comprising a node specific configuration file defining aplurality of nodes with which the handheld device can communicate and adifferent encryption means corresponding to each node in the pluralityof nodes wherein the handheld device is detectable by a plurality ofdetectors configured to sense a location of the handheld device andwherein the secure network comprises an identification controllercoupled to the secure network to generate an identification indicationas a function of the location of the handheld device and to determine byway of the handheld device an authentication of the body, wherein theauthentication is a function of an indication from the handheld devicethat the body sensor has not been removed from the body.
 2. The deviceof claim 1, wherein the plurality of detectors includes a detector tocommunicate via a florescent light.
 3. The device of claim 1, whereinthe body is a passenger in a vehicle.
 4. The device of claim 1, whereinthe identification controller is configured for granting access to asecure facility or area.
 5. The device of claim 1, wherein theidentification controller is configured for providing the identificationindication to a friendly fire prevention detection system.
 6. The deviceof claim 1, wherein the biometric information is obtainable from a groupconsisting of: a face scanner; palm scanner; retina scanner; afingerprint scanner; and combinations thereof.
 7. The device of claim 1,wherein the biometric information is indicative of removal of the bodysensor from the body.
 8. The device of claim 1, wherein the plurality ofdetectors includes a detector to communicate via a retro-reflectiveillumination.
 9. The device of claim 1, wherein the handheld devicecomprises a node of the secure network.
 10. A method comprising:sensing, by a handheld device comprising a processor, biometricinformation from a body; receiving, by the device, an agent module froma server node of secure network, the agent module comprising anode-specific configuration file defining a plurality of nodes withwhich the handheld device can communicate and a different encryptionmeans corresponding to each node in the plurality of nodes, wherein alocation of the handheld device is detectable by a plurality ofdetectors configured to sense a location of the handheld device, andwherein the secure network comprises an identification controllercoupled to the secure network to generate an identification indicationas a function of the location of the handheld device; and providing, bythe device, an authentication of the body to the identificationcontroller by way of the secure network.
 11. The method of claim 10,further comprising providing, by the device, an indication that a bodysensor of the handheld device to sense the biometric information has notbeen removed from the body.
 12. The method of claim 11, wherein theindication that the body sensor has not been removed from the bodyauthenticates the body.
 13. The method of claim 10, wherein theproviding of the authentication of the body is via a florescent light.14. The method of claim 10, wherein the sensing of the biometricinformation occurs within a vehicle.
 15. A device comprising: a handhelddevice comprising: a storage means to store program instructions; and aprocessor in communication with the storage means, wherein theprocessor, responsive to executing the program instructions, performsoperations comprising: sensing biometric information from a body;receiving an agent module from a server node of secure network, theagent module comprising a node-specific configuration file defining aplurality of nodes with which the handheld device can communicate and adifferent encryption means corresponding to each node in the pluralityof nodes, wherein a location of the handheld device is detectable by aplurality of detectors configured to sense a location of the handhelddevice, and wherein the secure network comprises an identificationcontroller coupled to the secure network to generate an identificationindication as a function of the location of the handheld device; andproviding an authentication of the body to the identification controllerby way of the secure network.
 16. The device of claim 15, the operationsfurther comprising providing an indication that a body sensor to sensebiometric information from the body has not been removed from the body.17. The device of claim 16, wherein the indication that the body sensorhas not been removed from the body authenticates the body.
 18. Thedevice of claim 15, wherein the providing of the authentication of thebody is via a florescent light.
 19. The device of claim 15, wherein thesensing of the biometric information occurs within a vehicle.